1057 matches found
cve-2026-41862 - HIGH - Kryo deserialization of persisted context without class allowlist
cve-2026-41862 - HIGH - Kryo deserialization of persisted context without class allowlist...
A Bootiful Podcast: Spring Security lead Rob Winch answers some security questions for me
Hi Spring and security fans! I got the legendary Spring Security lead Rob Winch to answers some of my burning security questions for us! Also: make sure you're downloading all the updates for the new Spring releases this week, the week of June 11th, 2026! or later...
cve-2026-41708 - HIGH - Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability
cve-2026-41708 - HIGH - Spring Cloud Sleuth instrumentation of Spring TX DoS vulnerability...
cve-2026-47825 - HIGH - Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations
cve-2026-47825 - HIGH - Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations...
cve-2026-40986 - MEDIUM - Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML
cve-2026-40986 - MEDIUM - Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML...
cve-2026-41700 - HIGH - Cross-Site WebSocket Hijacking in Spring for GraphQL
cve-2026-41700 - HIGH - Cross-Site WebSocket Hijacking in Spring for GraphQL...
cve-2026-40987 - HIGH - Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization
cve-2026-40987 - HIGH - Remote-file synchronizer in Spring Integration writes server-supplied filename under localDirectory without canonicalization...
cve-2026-40995 - MEDIUM - X.509 authentication bypasses Spring Security account checks
cve-2026-40995 - MEDIUM - X.509 authentication bypasses Spring Security account checks...
cve-2026-40998 - HIGH - Jaxp13 XPath XXE via StreamSource and SAXSource
cve-2026-40998 - HIGH - Jaxp13 XPath XXE via StreamSource and SAXSource...
cve-2026-40985 - MEDIUM - Data Binding Vulnerability in Spring Web Flow with Unified EL Parser
cve-2026-40985 - MEDIUM - Data Binding Vulnerability in Spring Web Flow with Unified EL Parser...
cve-2026-40999 - HIGH - Spring WS SSRF via unvalidated WS-Addressing reply destinations
cve-2026-40999 - HIGH - Spring WS SSRF via unvalidated WS-Addressing reply destinations...
cve-2026-40996 - MEDIUM - Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default
cve-2026-40996 - MEDIUM - Inbound WS-Security allows RSA PKCS1 v1.5 key transport by default...
cve-2026-40992 - MEDIUM - Mail Auto-Configuration Does Not Enable SSL Hostname Verification
cve-2026-40992 - MEDIUM - Mail Auto-Configuration Does Not Enable SSL Hostname Verification...
cve-2026-41856 - HIGH - Spring GraphQL Annotation Detection Vulnerability
cve-2026-41856 - HIGH - Spring GraphQL Annotation Detection Vulnerability...
cve-2026-41001 - MEDIUM - Predictable Temp Directory in Artemis Auto-configuration
cve-2026-41001 - MEDIUM - Predictable Temp Directory in Artemis Auto-configuration...
cve-2026-40997 - MEDIUM - SOAP security faults leak Spring Security account state
cve-2026-40997 - MEDIUM - SOAP security faults leak Spring Security account state...
cve-2026-40994 - HIGH - Wss4jSecurityInterceptor disables WS-I BSP validation by default
cve-2026-40994 - HIGH - Wss4jSecurityInterceptor disables WS-I BSP validation by default...
cve-2026-41699 - HIGH - Unsafe Deserialization in Spring GraphQL
cve-2026-41699 - HIGH - Unsafe Deserialization in Spring GraphQL...
cve-2026-41000 - LOW - WSS4J validation does not use configured replay cache
cve-2026-41000 - LOW - WSS4J validation does not use configured replay cache...
cve-2026-41714 - MEDIUM - In Spring AMQP the `RabbitConnectionFactoryBean.setUri("amqps://...")` bypasses secure SSL setup, uses `TrustEverythingTrustManager`
cve-2026-41714 - MEDIUM - In Spring AMQP the RabbitConnectionFactoryBean.setUri"amqps://..." bypasses secure SSL setup, uses TrustEverythingTrustManager...
cve-2026-41695 - HIGH - Denial of Service in Spring Data Commons Property Path Resolution
cve-2026-41695 - HIGH - Denial of Service in Spring Data Commons Property Path Resolution...
cve-2026-41731 - HIGH - In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization
cve-2026-41731 - HIGH - In Spring for Apache Kafka, overly broad trusted-package matching in header mappers exposes JDK classes to deserialization...
cve-2026-41701 - MEDIUM - In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues
cve-2026-41701 - MEDIUM - In Spring AMQP sequential correlation IDs enable reply poisoning on fixed reply queues...
cve-2026-41008 - MEDIUM - Spring Security Authorization Server Open Redirect via request_uri
cve-2026-41008 - MEDIUM - Spring Security Authorization Server Open Redirect via requesturi...
cve-2026-40991 - MEDIUM - XML External Entity (XXE) injection when documenting untrusted XML content
cve-2026-40991 - MEDIUM - XML External Entity XXE injection when documenting untrusted XML content...
This Week in Spring - June 9th, 2026
Hi Spring fans! Welcome to another installment of This Week in Spring! Tons of releases coming out today and this week! So make sure you're pulling in the latest posts, as often as possible! Spring LDAP 2026.06 Releases - Contains CVE Fix Spring Framework 7.0.8 and 6.2.19 Available Now Spring...
cve-2026-41696 - MEDIUM - Spring Data MongoDB Bind Parameter Literal Quoting Breakout
cve-2026-41696 - MEDIUM - Spring Data MongoDB Bind Parameter Literal Quoting Breakout...
cve-2026-40993 - HIGH - Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry
cve-2026-40993 - HIGH - Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry...
cve-2026-41837 - MEDIUM - Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys
cve-2026-41837 - MEDIUM - Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys...
cve-2026-41003 - HIGH - Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting
cve-2026-41003 - HIGH - Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting...
cve-2026-41727 - MEDIUM - In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior
cve-2026-41727 - MEDIUM - In Spring for Apache Kafka, forged retry topic headers subvert retry routing and backoff behavior...
cve-2026-41721 - MEDIUM - Spring Data Commons Denial of Service via Data Binding
cve-2026-41721 - MEDIUM - Spring Data Commons Denial of Service via Data Binding...
cve-2026-41697 - MEDIUM - Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern
cve-2026-41697 - MEDIUM - Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern...
cve-2026-41719 - MEDIUM - Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator
cve-2026-41719 - MEDIUM - Spring Data KeyValue - SpEL Injection vulnerability in SpelPropertyComparator...
cve-2026-41716 - HIGH - Spring Data web support unbounded negative-result cache keyed on attacker-supplied property names
cve-2026-41716 - HIGH - Spring Data web support unbounded negative-result cache keyed on attacker-supplied property names...
cve-2026-41728 - HIGH - Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections
cve-2026-41728 - HIGH - Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections...
cve-2026-41729 - HIGH - Spring Data REST SpEL Injection via Map Key in JSON Patch
cve-2026-41729 - HIGH - Spring Data REST SpEL Injection via Map Key in JSON Patch...
cve-2026-41711 - MEDIUM - Potential Denial of Service through crafted Sort Parameters
cve-2026-41711 - MEDIUM - Potential Denial of Service through crafted Sort Parameters...
cve-2026-41694 - LOW - SAML Payloads Decrypted Without Valid Signature
cve-2026-41694 - LOW - SAML Payloads Decrypted Without Valid Signature...
cve-2026-41717 - HIGH - Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding
cve-2026-41717 - HIGH - Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding...
cve-2026-47838 - MEDIUM - Unauthorized User Impersonation when Using X.509 Client Certificates
cve-2026-47838 - MEDIUM - Unauthorized User Impersonation when Using X.509 Client Certificates...
cve-2026-40988 - HIGH - Unbounded DEFLATE Inflation in SAML 2.0 Service Provider
cve-2026-40988 - HIGH - Unbounded DEFLATE Inflation in SAML 2.0 Service Provider...
cve-2026-41726 - MEDIUM - In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header
cve-2026-41726 - MEDIUM - In Spring for Apache Kafka, unbounded delegate cache keyed on user-controlled, potentially malicious selector header...
cve-2026-41706 - MEDIUM - Open Redirect When Using CookieRequestCache
cve-2026-41706 - MEDIUM - Open Redirect When Using CookieRequestCache...
CVE-2026-41840: Spring Framework Denial of Service via Multipart Requests in WebFlux
Spring WebFlux applications are vulnerable to Denial of Service DoS attacks when processing multipart requests. More precisely, an application can be vulnerable when all the following are true: When all the conditions above are met, an attacker can send malicious multipart requests that can leak...
cve-2026-41710 - MEDIUM - Cache Exhaustion in Stateful Retries leads to Denial of Service
cve-2026-41710 - MEDIUM - Cache Exhaustion in Stateful Retries leads to Denial of Service...
CVE-2026-41841: Spring Framework Information Disclosure via Static Resource Cache in Spring MVC and WebFlux
Spring MVC and WebFlux applications are vulnerable to Information Disclosure attacks when resolving static resources. More precisely, an application can be vulnerable when all the following are true: When all the conditions above are met, an attacker can get access to a protected resource if a...
cve-2026-40984 - HIGH - Micrometer HTTP server instrumentations DoS vulnerability
cve-2026-40984 - HIGH - Micrometer HTTP server instrumentations DoS vulnerability...
CVE-2026-41842: Spring Framework Denial of Service via Versioned Resources in Spring MVC and WebFlux
Spring MVC and WebFlux applications are vulnerable to Denial of Service DoS attacks when resolving static resources. More precisely, an application can be vulnerable when all the following are true: When all the conditions above are met, an attacker can send malicious requests that are slow to...